How do I configure deletion protection for devices? (PROTECTION_RULES)

[LHBL2003]

How do I configure deletion protection for devices?

Some time ago, I asked an FR #14996 to set up deletion protection for devices. I then learnt from jeremystretch that this should be possible with the following rule.

https://docs.netbox.dev/en/stable/configuration/data-validation/#protection_rules

As it happens, I didn't get round to setting it up and wanted to do it now. (Of course I deleted something by mistake again).

So I added this Protection Roles entry. If I now create a new device, I can delete it again immediately, although the status is "Active". At first I thought that my config was not working, but if I change something else in the config file and restart Netbox, then a change happens.

So how do I configure PROTECTION_RULES so that devices are not deleted when the status is Active?
This is inserted here, isn't it?
$INSTALL_ROOT/netbox/netbox/configuration.py

Thanks for your info

[candlerb]

So I added this Protection Roles entry

What exactly did you put there?

[LHBL2003]

This:

PROTECTION_RULES = {
    "dcim.site": [
        {
            "status": {
                "eq": "decommissioning"
            }
        },
        "my_plugin.validators.Validator1",
    ]
}

In the hope that you can only delete the devices if they are in the following status: decommissioning

[candlerb]

And what code did you provide for the custom validator, my_plugin.validators.Validator1 ?

[LHBL2003]

I am a clueless fool when it comes to validation. :D

I was also puzzled by the line in the example, which is why I left it out. I just copied it one-to-one from this link and had no success with it. From the description, it sounds like that's what I need. Only the code that is given is a bit confusing.

https://docs.netbox.dev/en/stable/configuration/data-validation/#protection_rules

[candlerb]

What version of Netbox are you using? PROTECTION_RULES were only added in v3.7.0

Otherwise, perhaps your PROTECTION_RULES setting isn't being picked up, e.g. it went in the wrong file: it would normally be /opt/netbox/netbox/netbox/configuration.py. You can always configure it via the web UI instead under "Admin > Config Revisions"

I was also puzzled by the line in the example, which is why I left it out

You can see a test case here: edc4a35#diff-a0fb2dfd5ca2af5b83efead658d613baea753bda6bfb7243e0b6f744e41b9592R195-R201

You don't need to provide any custom validator. But you did say you had included it in your config.

[LHBL2003]

I am currently using 3.7.1 snd yes, for me it is in the configuration file: /opt/netbox/netbox/netbox/configuration.py
At first I thought it was an installation error on my part because I have Netbox 3 times. Therefore I had given the link as in the example. (My mistake that has now led to confusion).

At least I knew that I had read validation somewhere on the website, I just couldn't remember where. I tried it once via the web frontend, but apparently I also entered it incorrectly there.

Can you give me an example of how to spell it correctly? Because that doesn't work.

[LHBL2003]

I have now updated to 4.0.0. And in the Admin --> Configuration History before and after area I created a configuration with a maximum page size of 500. And I can still select 1000 in each list. I think the configurations are never used by me.

[LHBL2003]

OK the config is partially loaded.
Then I just need to know how to enter the PROTECTION RULES correctly.

[candlerb]

From your original post:

So I added this Protection Roles entry. If I now create a new device, I can delete it again immediately, although the status is "Active"

Your protection rule is configured to protect dcim.site, not dcim.device. Try adding and deleting a site instead.

[bitcollector1]

These protection rules are pretty great! Thanks for the info folks!

[LHBL2003]

Summary of the solution

"dcim.site, not dcim.device" oh man, I could have thought of that myself :D
I completely ignored that. Thanks @candlerb for your great help.

So here's a summary for everyone (Tested in version 4.0.0):

Admin --> Configuration Config Revisions (v3.x.x) --> Add (or Edit last Config)
Admin --> Configuration History (> v4.0.0) --> Add (or Edit last Config)

Protection rules

{
    "dcim.device": [
        {
            "status": {
                "eq": "decommissioning"
            }
        }
    ]
}

If you navigate to a device, rack or site, you will find the path in the top right-hand corner.

Create a device and delete it:
Message: Deletion is prevented by a protection rule: ["Custom validation failed for status: ['Ensure this value is equal to decommissioning.']"]

I'll see if I can / may revise the article https://docs.netbox.dev/en/stable/configuration/data-validation/#protection_rules a little.